The vulnerability of the formSetSambaConf() function in the Tenda AC9 router microprogramming software allows a attacker to execute arbitrary commands.

The vulnerability of the formSetSambaConf function in the Tenda AC9 router’s microprogramming software is related to the lack of measures taken to neutralize special elements during the processing of the usb.samba.guest.user parameter. Exploiting this vulnerability allows a remote attacker to...

PT-2025-39198

Name of the Vulnerable Software and Affected Versions Tenda AC9 version 1.0 Description A command injection issue exists in Tenda AC9 version 1.0. The issue is due to a flaw in the formSetSambaConf function within the httpd file, specifically through the usb.samba.guest.user parameter. This allow...